CVE-2025-11240
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the attacker's choice. The problem has been fixed in KNIME Business Hub 1.16.0.
Risk Assessment
Users may be redirected to malicious sites, enabling phishing attacks and credential theft. The organization may suffer reputational damage and account security breaches.
Recommendation
Update KNIME Business Hub to version 1.16.0 or later. Additionally, train users to recognize suspicious links.
Other vulnerabilities in KNIME Business Hub
See all- CVE-2025-14262Medium
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if they were saved by the job owner. The attacker must have permissions to access the jobs, but they were saved into the catalog service using the wrong owner permissions, potentially allowing saves into spaces where the attacker lacks write permissions.
- CVE-2025-11239Medium
In KNIME Business Hub prior to 1.16.0, potentially sensitive information in jobs was visible to all team members. Starting with 1.16.0, only job metadata is shown to team members; only the job creator can see all information including in- and output data.
- CVE-2023-3140Medium
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before version 1.4.0 has left users vulnerable to clickjacking. This attack tricks users into clicking on actionable items, redirecting them to another server.
Original NVD description (English source)
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the attackers choice. This might open the possibility for fishing or other similar attacks. The problem has been fixed in KNIME Business Hub 1.16.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS